Loopback processing?

[Karl Breiner]

I would appreciate any advice on getting this to work.

Situation:

I have 5 PC's that act as "community" PC's whereby multiple users log
on. I like one group policy to be applied to these machines so they
get the same settings, regardless of who logs on.

Proposed solution:

I have placed the computers in a global group called G - RETREATROOM
PCs. I have a GPO at the domain level which has filtering placed on
it. The policy filters only to G - RETREATROOM PCs. The policy
contains both User and Computer Config settings that I would like
applied. Under Computer Configuration, I have Loopback Processing
enabled and set at "replace."

What happens:

I checked a target PC using GPRESULT, and the GPO is being applied,
however, only the Computer Config is appled. The User Config is not
applied, despite the fact that Loopback Processing is enabled. Why?

Other info:

Domain Functional Level: Windows 2000 native
Target PC's: All Windows XP sp2

Thanx,
Karl

 

[Denis Wong @ Hong Kong]

Hi Karl,

I think it's because you filtered the GPO.

Check out the KB NOTE part.

Loopback Processing of Group Policy
http://support.microsoft.com/kb/231287

NOTE: You cannot filter the application of user
settings by denying or removing the AGP and Read
rights from the computer object specified for the
loopback policy.

br,
Denis

 

[Karl Breiner]

Thanx, Denis. I'm still a little unclear as to what the note is
saying exactly, but I get the gist of it. Apparently, in a nutshell,
filtering computers with loopback processing does not work, although
I'm not sure of the reasoning behind it (I'm not sure of Microsoft's
reasoning behind a lot of things, come to think of it!).

Anyway, I accomplished my goal by creating an OU and sticking the
computer accounts in the OU instead of using the global group.
Although, I would have preferred my original idea because of the way
my AD is structured. I have all users in one OU, computers in
another, etc. Now I am breaking it up. But oh well.

-Karl